Hidden account creation (with fast deletion)

Detects scenarios where an attacker creates a hidden local account. See also rule "User account creation disguised in a computer account".